CVE-2025-15138
📋 TL;DR
This vulnerability in TinyFileManager allows attackers to perform path traversal attacks by manipulating the 'fullpath' parameter in tinyfilemanager.php. This could enable unauthorized file access or uploads. All users running TinyFileManager up to version 2.6 are affected.
💻 Affected Systems
- prasathmani TinyFileManager
📦 What is this software?
Tiny File Manager by Prasathmani
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through file upload combined with path traversal, potentially leading to complete system compromise.
Likely Case
Unauthorized file access, directory traversal, and potential file upload to arbitrary locations.
If Mitigated
Limited to file enumeration and read access if proper file permissions restrict write operations.
🎯 Exploit Status
Exploit details have been published online and the vulnerability is remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 2.6 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation for fullpath Parameter
allAdd input validation to sanitize the fullpath parameter and prevent directory traversal sequences.
Edit tinyfilemanager.php and add path sanitization before processing fullpath parameter
Web Application Firewall Rules
allImplement WAF rules to block directory traversal patterns in requests.
Add WAF rule to block requests containing '../', '..\', or similar traversal patterns
🧯 If You Can't Patch
- Remove or disable TinyFileManager from internet-facing systems
- Implement strict network access controls to limit access to TinyFileManager instances
🔍 How to Verify
Check if Vulnerable:
Check if TinyFileManager version is 2.6 or earlier by examining the software version in the interface or source files.Check Version:
Check the version in tinyfilemanager.php header or configuration filesVerify Fix Applied:
Test path traversal attempts with payloads like '../../etc/passwd' in the fullpath parameter to verify they are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or '..\' patterns in parameters
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests with path traversal payloads in URL parameters
SIEM Query:
web.url:*../* OR web.param:*../*